1berry/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: mux-spop: Fix null-pointer deref on SPOP stream allocation failure

Browse Source 
When we try to allocate a new SPOP stream, if an error is encountered,
spop_strm_destroy() is called to released the eventually allocated
stream. But, it must only be called if a stream was allocated. If the
reported error is an SPOP stream allocation failure, we must just leave to
avoid null-pointer dereference.

This patch should fix point 1 of the issue #2993. It must be backported as
far as 3.1.
This commit is contained in:
Christopher Faulet 2025-06-04 08:48:48 +02:00
parent 6786b05297
commit 8c4bb8cab3
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/mux_spop.c
View File

@ -1260,7 +1260,8 @@ static struct spop_strm *spop_stconn_new(struct spop_conn *spop_conn, struct stc
out:
TRACE_DEVEL("leaving on error", SPOP_EV_SPOP_STRM_NEW|SPOP_EV_SPOP_STRM_END|SPOP_EV_SPOP_STRM_ERR, spop_conn->conn);
spop_strm_destroy(spop_strm);
if (spop_strm)
spop_strm_destroy(spop_strm);
return NULL;
}